Zions Bancorporations Enterprise Technology and Operations (ETO) team is transforming what it means to work for a financial institution. With a commitment to technology and innovation, we have been providing our community, clients and colleagues the best experience possible for over 150 years. Helpus transform our workforce of the future, today.We are currently seeking aSenior Cyber Incident Response Engineeras part of our Enterprise Information Security department. Enterprise Information Security (EIS) is integrated with the Enterprise Technology and Operations division (1100+ technical people) at Zions Bancorporation. EIS is responsible for enabling secure innovation and business growth for 10,000+ employees across 11 states. EIS is undergoing rapid growth and we are focused on creating a relevant program that will enable our organizations long-term success. Whats great about our department is that we laugh with each other, have Executive and Board level visibility and support for our work, and are driving highly visible, enterprise-wide initiatives. We are focused on creating business value and are seeking like-minded professionals to join our team!The Senior Cyber Incident Response Engineer will join our CSOC Team. The Cybersecurity Operations Center (CSOC) team is the cyber front line at Zions Bancorporation. If you want to work on a team where your input matters, you get to collaborate with sharp colleagues with whom you will grow, where your work is truly valued and you make a real difference, then you will be in good company.As a Senior Cyber Incident Response Engineer you will play a key role in defending the enterprise from malicious actors. The work you do has real impact customer-wide and enterprise-wide and it is truly valued by both.The Senior Cyber Incident Response Engineer will:Act as key contributor in the CSOCs growth and evolution, actively improving our cyber incident response capabilitiesRespond to cybersecurity incidents, especially as an escalation point for high-priority or highly complex incidentsFunction as subject matter expert in multiple cybersecurity tools and processes such as SIEM, IDS, EDR, DLP, WAF and similarDevelop and implement monitoring use cases, cyber incident response procedures, playbooks and other technical documentationCollaborate with Enterprise Cybersecurity Architecture and technology teams in monitoring and alerting infrastructure, processes, and toolsTrain, mentor and guide other team members (across both the CSOC and other EIS teams) on cyber incident response practices, tooling, and capabilitiesParticipate in the on-call rotation so we can maintain 24/7 coverage in responding to alerts and possible threatsOther duties as assignedRequirements:Hands-on technical experience with one or more commercial SIEM products such as Splunk (preferred), IBM QRadar, LogRhythm, ArcSight, NetWitness, etc., which should include familiarity with defining and writing alert conditions/use cases in addition to daily use for investigating incidentsExperience producing technical documentation, standard operating procedures, and incident response playbooksExpert technical knowledge in networking, Windows administration, Linux administration, common attack techniques and preventionsAdvanced working knowledge of common attack vectors, different classes of attacks (e.g., passive, active, insider, close-in, distributed, etc.) and general attack stages (e.g., foot printing and scanning, enumeration, gaining access, escalation or privileges, maintaining access, network exploitation, covering tracks, etc.)Advanced knowledge of system administration concepts for UNIX/Linux and Windows operating systemsDevelopment experience with scripting languages such as R, HIVE, Python, JavaScript, etc., is a plusExperience with any Endpoint Detection and Response platform is a plusRelevant advanced technical certifications are a plus (ex: SANS, ISC2)A Bachelors in Information Technology, Computer Science, Information Systems, or a related technical field plus 5+ years of relevant experience in one or more technical cybersecurity domains (combination of education and experience, such as 6-8 years of relevant experience or equivalent education may meet qualifications)Location:This position can be located100% remotewithin the United States orlocated at the Zions Technology Center in Midvale, UTPay Range:$130K – $170K (based upon relatable skills and experience)Benefits:Medical, Dental and Vision Insurance – START DAY ONE!Life and Disability Insurance, Paid Parental Leave and Adoption AssistanceHealth Savings (HSA), Flexible Spending (FSA) and dependent care accountsPaid Training, 20 days of Paid Time Off (PTO) and 11 Paid Federal Holidays401(k) plan with company match, Profit Sharing, competitive compensation in line with work experienceMental health benefits including coaching and therapy sessionsTuition Reimbursement for qualifying employeesEmployee Ambassador preferred banking productsEmployees may, at the companys discretion, be eligible to receive a cash bonus awardApply now if you have a passion for impactful outcomes, enjoy working collaboratively with co-workers, and want to make a difference for the clients and communities we serve.
Associated topics: active security clearance, army, c2bmc, coast guard, department of homeland security, geospatial intelligence, polygraph, top secret with sci, ts clearance, ts sci required
Intrusion Detection System (IDS) Splunk SIEM Python Computer Science R Endpoint Detection and Response (EDR) JavaScript Linux Networking Apache Hive Information technology (IT) Information Systems IBM QRadar ISC2 arcsight waf